A bus system is known in which messages are transmitted using the CAN protocol, as described in the CAN Specification in ISO11898.
German Published Patent Application No. 100 00 305 describes the CAN (Controller Area Network=Steuereinrichtungsnetzwerk in German) as well as an elaboration of it designated as TTCAN (Time Triggered CAN=Zeit getriggertes CAN in German).
CAN and TTCAN work with a message-based protocol and are used in vehicles, for example. A bus system based on CAN or TTCAN enables all user stations connected to it, such as microcontrollers, to communicate with one another.
In the current CAN protocol (ISO 11898-1) the size of the data field is limited to 8 bytes. Therefore the message memories (mail boxes) of the user stations of the CAN, which may also be designated as hardware CAN modules, are also limited to 8 data bytes. The document “CAN with Flexible Data-Rate, White Paper, Version 1.0”, published on May 2, 2011 on Internet page http://www.semiconductors.bosch.de/, introduces a data transmission protocol that is modified with respect to ISO 11898-1 which, among other things, enables an enlargement of the data field as well as a shortening of the bit length for a part of the CAN message after an arbitration has taken place.
The mail boxes may be implemented as RAM (random access memory) or as register cells. In this instance, it is possible to implement the mail boxes in an external RAM. In this case, buffer storage is provided in the user station, in which a complete CAN message is stored before this CAN message is sent via the CAN bus. The CAN message that is to be stored in buffer storage is loaded word-by-word from the RAM. The transmission of the message begins only when the buffer storage is fully loaded. The buffer storage prevents the CAN protocol controller of a user station, during a running transmission, from getting to a point at which it has no valid data bytes available, because, for example, the RAM is reporting a parity error, or because the reading out of the RAM is delayed because of access conflicts.
It is a problem, however, that in the CAN protocol the possibility of a memory access error is not taken into consideration. A termination of the running transmission would be a violation of the CAN protocol and another signaling of the invalidity of the data is not provided.
As a design approach to this problem, currently, for example, a within-CRC checksum or other test data are sent along with the data field, in order to protect the data path within the CAN system This reduces the useful data rate, however, and puts a load on the application software.